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IN THE CLAIMS 

Please amend the claims as follows: 

1 . (Currently Amended) A method to detect fraudulent activities at a network-based 
transaction facility, the method comprising: 

causing a first identifier associated with a first user identity to be stored on a machine 
responsive to a first sales-related event with respect to the network-based 
transaction facility and initiated under the first user identity from the machine 
which is coupled to the network-based transaction facility via a network; and 

detecting a potentially fraudulent activity by detecting a lack of correspondence between 
the first identifier stored on the machine and a second identifier associated with a 
second user identity responsive to a second sales-related event with respect to the 
network-based transaction facility and initiated under the second user identity 
from the machine. 

2. (Currently Amended) A method as in claim 1 comprising causing the second identifier to 
be stored on the machine in responsive to the second sales-related event. 

3. (Original) A method as in claim 2 comprising causing the lack of correspondence 
between the first identifier and second identifier to be detected at the machine. 

4. (Original) A method as in claim 3 comprising receiving both the first identifier and the 
second identifier at the network-based transaction facility from the machine, and 
detecting the lack of correspondence between the first identifier and second identifier at 
the network-based transaction facility. 

5. (Original) A method as in claim 4 comprising recording of the potentially fraudulent 
activity at the network-based transaction facility responsive to a detection of the lack of 
correspondence between the first identifier and the second identifier. 
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6. (Currently Amended) A method as in claim 5 wherein the second sales-related event is a 
sales transaction event, the method further comprising prohibiting a completion of the 
sales transaction event responsive to the detection of the lack of correspondence between 
the first identifier and the second identifier. 

7. (Original) A method as in claim 6 comprising causing the first identifier to be stored on 
the machine within a cookie. 

8. (Original) A method as in claim 7 comprising causing the first identifier and the second 
identifier to be recorded with the cookie. 

9. (Currently Amended) A method as in claim 8 wherein the first sales-related event 
includes one of registering with the network-based transaction facility, communicating an 
offer to sell an offering via the network-based transaction facility, communicating and 
offering to purchase the offering via the network-based transaction facility, 
communicating a feedback regarding a transaction, and updating a profile maintained by 
the network-based transaction facility. 

10. (Currently Amended) A method as in claim 9 wherein the sales transaction event 
includes one of registering with the network-based transaction facility, communicating an 
offer to sell an offering via the network-based transaction facility, communicating and 
offering to purchase the offering via the network-based transaction facility , 
communicating a feedback regarding a transaction, and updating a profile maintained by 
the network-based transaction facility. 
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1 1 . (Currently Amended) A method as in claim 1 0 comprising: 

causing the first identifier and the second identifier to be stored on the machine with a 
shill cookie; 

causing a cookie identifier to be stored with the shill cookie; 

causing the shill cookie to be coupled to a cookie bundle which records a plurality of 
transaction preferences for the fist user identity and the second user identity on 
the machine; 

causing the shill cookie bundle to be sent from the machine to the network-based 
transaction facility when the second user identify makes the second sales 
transaction event with the network-based transaction facility using the machine; 

causing the shill cookie to be appended with the second identifier responsive to the 

detection of the lack of correspondence between the first identifier and the second 
identifier at one of the machine and the network-based transaction facility; 

causing the cookie bundle to be inspected for the potentially fraudulent activity; and 

causing the potentially fraudulent activity to be recorded into a database. 

12. (Original) A method as in claim 1 1 wherein an inspection of the shill cookie comprises a 
source for the detection of the lack of correspondence between the first identifier and the 
second identifier. 



13. (Original) A method as in claim 12 further comprising: 

causing the cookie bundle to be a non-session cookie residing on the machine for a 
predetermined amount of time. 

14. (Original) A method as in claim 13 further comprising: 

causing the shill cookie to be appended every time a new user identifier is used to 
establish a new event with the network-based transaction facility using the 
machine wherein there is a lack of correspondence between the new user 
identifier and the first user identifier. 
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15. (Original) A method as in claim 14 wherein the machine comprises a computer connected 
to the network-based transaction facility. 



16. (Original) A method as in claim 15 wherein the network-based transaction facility 
comprises an Internet-based auction facility. 

17. (Original) A method as in claim 16 further comprising: 

causing the shill cookie to record and to store a predetermined number of user identifiers. 

18. (Original) A method as in claim 17 further comprising causing the shill cookie and the 
cookie bundle to be encoded such that the shill cookie and the bundle cookie are coded. 

19. (Original) A method as in claim 18 further comprising causing the shill cookie and the 
cookie bundle to be encrypted. 

20. (Original) A method as in claim 19 further comprising: 

generating a potential fraudulent activities table having a fraudulent activity field, a 

cookie identifier field, a user identifier field, and a frequency field; 
recording each of the potentially fraudulent activities and corresponding information into 

the potential fraudulent activities table; 
updating the potential fraudulent activities table at least on a periodic basis; and 

providing an updated report of the potential fraudulent activities table to an 

investigation team 

2 1 . (Original) A method as in claim 20 further comprising: 

configuring the potential fraudulent activities table to include a transaction product 

category field, a transaction country field, a transaction price range field, and a 
transaction activity field. 
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22. (Original) A method as in claim 21 wherein the new event includes one of registering 
with the network-based transaction facility, communicating an offer to sell an offering 
via the network-based transaction facility, communicating and offering to purchase the 
offering via the network-based transaction facility, communicating a feedback regarding 
a transaction, and updating a profile maintained by the network-based transaction facility. 



23. (Original) A method as in claim 22 further comprising providing the updated report to 
the investigation team at a predetermined time. 

24. (Original) A method as in claim 23 further comprising providing the network-based 
transaction facility with a capability to override the updated report to the investigation 
team as necessary. 

25. (Original) A method as in claim 24 further comprising providing a priority ranking 
system having a low priority for a low potential fraudulent activity frequency, a medium 
priority for a medium potential fraudulent activity frequency and a high priority for a 
high potential fraudulent activity frequency. 

26. (Original) A method as in claim 25 further comprising examining the updated report to 
confirm the potentially fraudulent activity. 

27. (Original) A method as in claim 26 wherein the potentially fraudulent activity includes 
one of shill biddings and shill feedbacks. 

28. (Currently Amended) A method as in claim 27 wherein the recording does not affect any 
one of the first sales-related event, the second sales-related event, and the new event. 

29. (Original) A method as in claim 28 further comprising causing the detection of the 
potentially fraudulent activity responsive a matching of at least two user transaction 
preferences from at least two different user identifies. 
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30. (Original) A method as in claim 29 wherein the user transaction preferences comprise 
credit card numbers, bidding histories, payment methods, and shipping addresses. 



3 1 . (Currently Amended) A computer readable medium comprising instructions, which 
when executed on a processor, cause the processor to perform a method for detecting 
suspicious transactions made over a network-based transaction facility using a client 
machine, the method comprising: 

causing a first identifier associated with a first user identity to be stored on a machine 
responsive to a first sales-related event with respect to the network-based 
transaction facility and initiated under the first user identity from the machine 
which is coupled to the network-based transaction facility via a network; and 

detecting a potentially fraudulent activity by detecting a lack of correspondence between 
the first identifier stored on the machine and a second identifier associated with a 
second user identity responsive to a second sales-related event with respect to the 
network-based transaction facility and initiated under the second user identity 
from the machine. 

32. (Currently Amended) A method for detecting suspicious transactions made with an 
Internet service facility from one computerized facility, the method comprising: 
causing a first identifier associated with a fist user identity to be stored on a machine, the 

causing being responsive to a first sales-related event with respect to the network- 
based transaction facility and initiated under the first user identity from the 
machine which is coupled to the network-based transaction facility via a network; 
and 

detecting a potentially fraudulent activity by detecting a lack of correspondence between 
the first identifier stored on the machine and a second identifier associated with a 
second user identity, the detecting being responsive to a second sales-related 
event with respect to the network-based transaction facility and initiated under the 
second user identity from the machine. 
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33. (Currently Amended) A system to detect fraudulent activities at a network-based 
transaction facility, the system comprising: 

an identifier proc e ss processor to cause a first identifier associated with a first user 

identity to be stored on a machine responsive to a first sales-related event with 
respect to the network-based transaction facility and initiated under the first user 
identity from the machine which is coupled to the network-based transaction 
facility via a network; and 

a first detection process processor to detect a potentially fraudulent activity by detecting a 
lack of correspondence between the first identifier stored on the machine and a 
second identifier associated with a second user identity responsive to a second 
sales-related event with respect to the network-based transaction facility and 
initiated under the second user identity from the machine. 

34. (Currently Amended) A system as in claim 33 comprising a second detection proc e ss 
processor to cause the lack of correspondence between the first identifier and second 
identifier to be detected at the machine. 

35. (Currently Amended) A system as in claim 34, wherein said second detection proc e ss 
processor includes rec e iving to receive both the first identifier and the second identifier at 
the network-based transaction facility from the machine, and to detect d e t e cting the lack 
of correspondence between the first identifier and second identifier at the network-based 
transaction facility. 

36. (Currently Amended) A system as in claim 35 comprising a first recording process 
processor to record the potentially fraudulent activity at the network-based transaction 
facility responsive to a detection of the lack of correspondence between the first identifier 
and the second identifier. 
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37. (Currently Amended) A system as in claim 36 comprising a cookie recording proc e ss 
processor to record the first identifier and the second identifier to be recorded within a 
cookie. 



38. (Currently Amended) A system as in claim 37 comprising: 

a storing proc e ss processor to cause the first identifier and the second identifier to be 

stored on the machine within a shill cookie and a cookie identifier to be stored 

within the shill cookie; 
a bundling proc e ss processor to cause the shill cookie to be coupled to a cookie bundle 

which records a plurality of transaction preferences for the first user identity and 

the second user identity on the machine; 
a sending proc e ss processor to cause the shill cookie bundle to be sent from the machine 

to the network-based transaction facility when the second user identify makes the 

second sales transaction event with the network-based transaction facility using 

the machine; 

an appending proc e ss processor to cause the shill cookie to be appended with the second 
identifier responsive to the detection of the lack of correspondence between the 
first identifier and the second identifier at one of the machine and the network- 
based transaction facility; 

an inspection proc e ss processor to cause the cookie bundle to be inspected for the 
potentially fraudulent activity; and 

a second recording proc e ss processor to cause the potentially fraudulent activity to be 
recorded into a database. 



39. (Currently Amended) A system as in claim 38 further comprising: 

a tabulating proc e ss processor to generate a potential fraudulent activities table having a 
fraudulent activity field, a cookie identifier field, a user identifier field, and a 
frequency field; 

a third recording proc e ss processor to record each of the potentially fraudulent activities 
and corresponding information into the potential fraudulent activities table; 
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an updating proc e ss processor to update the potential fraudulent activities table at least on 
a periodic basis and to provide an updated report of the potential fraudulent 
activities table to an investigation team. 



40. (Currently Amended) A system to detect fraudulent activities at a network-based 
transaction facility, the system comprising: 

a first means for causing a fist identifier associated with a first user identity to be stored 
on a machine responsive to a first sales-related event with respect to the network- 
based transaction facility and initiated under the first user identity from the 
machine which is coupled to the network-based transaction facility via a network; 
and 

a second means for detecting a potentially fraudulent activity by detecting a lack of 

correspondence between the first identifier stored on the machine and a second 
identifier associated with a second user identity responsive to a second sales- 
related event with respect to the network-based transaction facility and initiated 
under the second user identity from the machine. 



